Tuesday, May 3, 2011

How to use hot spare disks properly?

Hotspare is a good option, but the hard drive which is used as hot spare ought to be tested every now and again.
Let's consider such a situation - you decide to build your own RAID array and put N disks (including the hot spare disk) to the RAID array.
In this case there exists 1/N probability that the first disk to fail happens to be a hotspare disk.

Then when one of the RAID array member disks fails you are surprised to learn that the hotspare is unable to replace a failed member disk.
To avoid this you need to check a hot spare disk or stick to RAID6E or RAID 5E/EE array levels.

Monday, April 4, 2011

URE - real or not?

When studying hard drive's documentation provided by vendors you can easily note that often manufacturers provide, to put it mildly, not real URE (Unrecoverable Read Error) values.

This URE specification is commonly applied to support bogus conclusions like "RAID 5 is dead" or to get chances of double read error in RAID5. Problem is, the vendor values are very far off the mark.

 Read documentation on Hitachi website, where very interesting URE values are given, e.g. for 3 TB disk - 10-14 errors per bit read. Let's assume that this value is real. Thus, if you buy the given disk and start reading data off it from the beginning to the end then the probability not to encounter a read error is :

(1- 10-14)(8*3*1012)~0,79
 so the probability that the hard disk wouldn't be able to read one sector is about 20 percent.

All the above means that when you are dealing with a disk completely filled there is a 20% chance that you are not be able to read data off it. This is obviously demonstrated wrong by everyday usage.

Monday, March 14, 2011

Can RAID 1 (mirror) improve average access time?

Although they say RAID does not improve access time, supposedly, RAID 1 is able to improve average access time (but not random access time) during the read.

As you know there are two same copies of data and two member disks in RAID 1.

 When read operations are grouped as described below:
  • the first half of the data is served by the first disk
  • second disk is responsible for the second part of the data
then the average length which a read head should go to find a sector is reduced in half.
Based on the above considerations it is not possible to improve rotational latency. Anyway, performance improves because less head travel is needed. As for writes, it is not possible to improve performance since both disks should be updated.

Tuesday, March 1, 2011

Why are only the image thumbnails recovered?

More often than not when recovering digital images, typically off a memory card, the image thumbnails are extracted OK, while high-resolution images themselves are not.
There is a phenomenon called "file fragmentation", when the file is placed on the disk in several non-contiguous parts. The sketch showing the process can be seen at the Photo Recovery Limitations page

As a rule memory cards are formatted to FAT or FAT32. If the file gets erased on FAT, only the information how to locate its first fragment remains available. The second and the following fragments cannot be located.
Thumbnail is not big and it is placed near to the start of the file, therefore it can be often recovered successfully, whilst the full-size image is lost. Of all the recovery types, this limitation mostly applies to digital image recovery and unformat on FAT.

Thursday, February 10, 2011

"Do you want to format it?"

It may happen when you disconnect the external hard drive (memory card) not using "safely remove hardware" option, the next time you connect the drive Windows will say "Do you want to format it"?
In most cases such a behavior means that you have a RAW filesystem. Obviously, initial file system was corrupted because those data that was in the buffer during disconnection of the storage device was lost due to such a disconnection.

You can easily solve the problem by just formatting the drive - but... the data would be gone away irreversibly. If the data is important you should retrieve data first and after that perform the format procedure. Data recovery in case of RAW filesystem is similar to unformat but typically more effective. It is very easy to do - just try any data recovery utility.

Thursday, January 6, 2011

Secure Erase at home

The best option to wipe the content from a drive is to destroy it by use of force. Either melt it in fireplace or drill it in many places. Problem is, nobody is going to buy the disk after that.

Software-wise, there are quite a few tools both free and paid that would overwrite the data using either zeros or random sequence for you. Once overwritten, the information is lost forever.
To get the same effect yourself as with the secure erase software, just format the hard drive and then fill it to its full capacity with any insecure data (similar to many copies of Mickey Mouse DVD iso). When the big file fits no more, continue adding some smaller files.

On Full Encryption drives, just changing a password achieves pretty much the same effect as after a secure erase.